# What does the community think to Carlton's take on auth.User? **URL:** \ **Category:** Django Internals\ **Created:** [September 10, 2024, 1:08pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672 "2024-09-10T13:08:03Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![nanorepublica](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nanorepublica/32/14211_2.png) [@nanorepublica](https://forum.djangoproject.com/u/nanorepublica)\ **Post date:** [September 10, 2024, 1:08pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/1 "2024-09-10T13:08:03Z")
I enjoyed reading Carlton’s latest [Stack Report](https://buttondown.com/carlton/archive/evolving-djangos-authuser/) on where to take the auth.User model. He makes a solid case and outlines some next steps. In this topic I would want to focus on the documentation changes he suggests. Specifically: 1. Remove the recommendation of requiring a custom User 2. Tone down the warning about mid-project migrations 3. Add a User Profile “How-To” section 4. (One from me) - Broadly document the steps required for a mid project migration. These seem like reasonable first steps that on the face of it don’t appear to be too contentious? ---
**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\ **Post date:** [September 10, 2024, 2:25pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/2 "2024-09-10T14:25:58Z")
Thanks @nanorepublica. Just to be clear, I think steps 1 and 2 there are exhausted by something along the lines of the draft PR I’ve put up here: > > > This is a draft PR to show the changes I have in mind, to link from the Forum di…scussion: > > https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672 > > Ticket etc. may follow later. I hope that’s not too radical for anyone 😅 To quote the _Action Points_ at the very end of the essay you linked: > At the least I’d like us to remove the _highly recommended_ line about custom user models. Even if you think I’m mad, you must see that having that there is harmful for beginners. > > At the same time we should tone down the warning about migrating to a custom user model mid-project. I’ve argued there’s no reason to do it, but even so, it’s not **that hard**. We can say it’s involved, without giving people heart attacks. I’d hope we could get that far at least. My plan is to recruit @wsvincent to lead author the _Profile How To_ at DjangoCon this year 😜 ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [September 10, 2024, 2:37pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/3 "2024-09-10T14:37:39Z")
(Gotta do a little bike-shedding here) I’d love to see you drop the word “somewhat” in the second change. I agree that in many cases, changing the user model isn’t _horrible_ - but there are also a number of cases where it becomes a nightmare. (Usually when things weren’t done “right” at the start, but then we don’t always do things perfect at the beginning.) I’d love to see some type of wording (without it becoming too long) that expresses the idea that it might be a simple operation, or it could end up being extremely complex. ---
**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\ **Post date:** [September 10, 2024, 2:41pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/4 "2024-09-10T14:41:12Z")
> [@KenWhitesell](#): > > (Gotta do a little bike-shedding here) > I’d love to see you drop the word “somewhat” in the second change. [No objections to that](https://github.com/django/django/pull/18566/files#r1752121039) @KenWhitesell 😉 ---
**Author:** ![wsvincent](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/wsvincent/32/52_2.png) [@wsvincent](https://forum.djangoproject.com/u/wsvincent)\ **Post date:** [September 10, 2024, 2:49pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/5 "2024-09-10T14:49:28Z")
@cartlon I’m happy to do a docs version of this basically: [Django UserProfile Model | LearnDjango.com](https://learndjango.com/tutorials/django-userprofile-model) Just need to know that people want it 🙂 ---
**Author:** ![CodenameTim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codenametim/32/31507_2.png) [@CodenameTim](https://forum.djangoproject.com/u/CodenameTim)\ **Post date:** [September 10, 2024, 3:03pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/6 "2024-09-10T15:03:49Z")
These all seem like reasonable steps to be made. 3 and 4 can be done separately and don’t need to be part of a larger User re-imagining either. Regarding 4, I’m not sure of the process of how to add those more advanced guides to the docs. I’d like to see it done. I suspect the first step is write a blog post that shows it, get feedback, then attempt a upstream merge of it? ---
**Author:** ![nanorepublica](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nanorepublica/32/14211_2.png) [@nanorepublica](https://forum.djangoproject.com/u/nanorepublica)\ **Post date:** [September 10, 2024, 3:16pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/7 "2024-09-10T15:16:02Z")
On point 4 I have seen [this article](https://testdriven.io/blog/django-custom-user-model-migration/) referenced in the past. It’s probably a good starting point for it. ---
**Author:** ![markwalker](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/markwalker/32/7075_2.png) [@markwalker](https://forum.djangoproject.com/u/markwalker)\ **Post date:** [September 10, 2024, 6:00pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/8 "2024-09-10T18:00:26Z")
Just passing through to +1 this & do some bike-shedding of my own on that PR 👀 ---
**Author:** ![nessita](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nessita/32/12194_2.png) [@nessita](https://forum.djangoproject.com/u/nessita)\ **Post date:** [September 16, 2024, 11:53am UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/9 "2024-09-16T11:53:39Z")
I was finally able to complete the reading of Carlton’s post, and I can’t agree more with what he suggests/proposes. With my non-Fellow hat on, let me share that I have always been critical of the “custom user model option” and, in all honesty, never fully grasped it (or used it). I always preferred to use 1-1 profiles to do what I needed, and I see the `User` model as a mere placeholder for the “entity that represents an authenticated being”. This means I heavily rely on `User` for everything authentication-related, but any metadata or logic beyond that is in a new model with a 1-1 to `User`. What I don’t see mentioned in the article (and I think I understand why – the article is about the `User` model and improvements for it, not a whole redesign) is how to support, nicely, decoupled authentication (“Is this user who they say they are?”) and authorization (“Can this user perform action X?”) flows. This is something I would eventually love to see improved in Django. In summary, I’m +1 to the immediate changes, including: - Proposed docs changes (will do that PR review soonish) - Pushing for a _Profile How-To_ A medium-term initiative would be evaluating and including in core `django-unique-user-email`, which I haven’t inspected yet. In the medium to long term, I’m +1 on working on a plan where custom `User` models get deprecated-ish or documented as a last resort. ---
**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\ **Post date:** [September 16, 2024, 4:25pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/10 "2024-09-16T16:25:26Z")
Thanks @nessita. Following the discussion, various posts online, and the numerous hearts and +1s, here and on the PR, I’ve opened two Django tickets to push forward the small docs changes, and the _Profile How-To_. [https://code.djangoproject.com/ticket/35767](https://code.djangoproject.com/ticket/35767) I updated the PR for this, to take into account the feedback, and rebased, ready for review. [https://code.djangoproject.com/ticket/35768](https://code.djangoproject.com/ticket/35768) @wsvincent I assigned you this one based on your reply above. Looking forward to chatting with you about it about DjangoCon. Thanks all. 🎁 ---
**Author:** ![wsvincent](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/wsvincent/32/52_2.png) [@wsvincent](https://forum.djangoproject.com/u/wsvincent)\ **Post date:** [September 16, 2024, 5:37pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/11 "2024-09-16T17:37:09Z")
I think it’s worth pointing out the 2012 Wiki on this topic and the fact that Option #5, which @jacobian liked at the time, was in line with this: [ContribAuthImprovements – Django](https://code.djangoproject.com/wiki/ContribAuthImprovements#Solution5:Profile-basedsingleusermodel) Further context here: [Upgrading auth.User - the profile approach · GitHub](https://gist.github.com/jacobian/2245327) ---
**Author:** ![GitRon](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/gitron/32/13088_2.png) [@GitRon](https://forum.djangoproject.com/u/GitRon)\ **Post date:** [September 20, 2024, 10:04am UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/12 "2024-09-20T10:04:03Z")
Just wanted to drop a quick +1 to this topic. I agree with basically everything Carlton wrote and especially having a plug-and-play way of switching auth methods from username to email to [your-solution] would be amazing. ---
**Author:** ![doom](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@doom](https://forum.djangoproject.com/u/doom)\ **Post date:** [September 20, 2024, 9:03pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/13 "2024-09-20T21:03:57Z")
I agree with that. Oddly enough, if you actually read the [Customizing authentication in Django | Django documentation | Django](https://docs.djangoproject.com/en/5.1/topics/auth/customizing/#specifying-custom-user-model) it no longer is “highly recommended”, but rather wary: “stop to consider if this is the right choice”. 🙂 ---
**Author:** ![tom](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/tom/32/6818_2.png) [@tom](https://forum.djangoproject.com/u/tom)\ **Post date:** [September 21, 2024, 1:41pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/14 "2024-09-21T13:41:48Z")
I agree with this, with a bit of a caveat. What I really want to see is good support for using different types of identifiers for logging in. I will go with the email example because it’s what I personally use almost always. Without needing a second model or a custom user, how would I do the following: - Have the login identifier be an email field, with correct length and validation? - Ideally enforce in this in the database via constraints, e.g. that the email is case-insensitively unique? - Related to the above, ensure I can query on it quickly? I’m also interested in how we’d add extra (but very auth related) bells and whistles, for example:, storing that the email has been verified, but separate from `is_active`. And finally if this would include a plan to remove (optionally? over an extended deprecation?) the non-auth related fields, especially first/last name. Most of these things are addressed in your post. But I would be against, for example, having both a username and email but only using one of them. I would like to see some easy to use options where you can choose which you want to live in the database (which should include either or both). Which leaves me wondering how to do this. With extra models and `User` is close to empty? Could work. But I do agree with all of the immediate action points, which is what this post is about anyway 🙂 Sorry, a bit rambly, could have been more concise. ---
**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\ **Post date:** [September 22, 2024, 7:34pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/15 "2024-09-22T19:34:13Z")
> [@tom](#): > > Most of these things are addressed in your post. Yes, they are 🙂, but let me just say what I think, to be clear. Ultimately I would strip User down to (more or less) just an ID field to be the target of foreign keys from other models. Authentication credentials (be it log in by username, email, or anything else) **should** live in separate models, so you can add whichever you need, with Django providing the base interface, and then the core implementations that are most common. We’re a long way from there, so it’s a question of slowly slowly. Current status is proof-of-concepts showing that we **can** evolve `auth.User`. It’s been a long-time held that we just simply couldn’t, and I think that’s where we gave up too early. (An _in the meantime_ strategy I’m quite keen on is just ignoring offending fields, and assuming we already got there, of course.) ---
**Author:** ![nanorepublica](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nanorepublica/32/14211_2.png) [@nanorepublica](https://forum.djangoproject.com/u/nanorepublica)\ **Post date:** [September 22, 2024, 9:14pm UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/16 "2024-09-22T21:14:48Z")
From what I can tell, accepted tickets exist for all of the proposed points I outlined in the original ticket (either new or existing) 1. (& 2) [#35767 (Don't recommend using a custom user model when starting a new project) – Django](https://code.djangoproject.com/ticket/35767) 2. [#35768 (Add a User Profile How-To to docs) – Django](https://code.djangoproject.com/ticket/35768) 3. [#25313 (Document how to migrate from a built-in User model to a custom User model) – Django](https://code.djangoproject.com/ticket/25313) Can we lock this topic as I would suggest that any further discussion be focused in a new topic for any other changes? ---
**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\ **Post date:** [September 23, 2024, 12:36am UTC](https://forum.djangoproject.com/t/what-does-the-community-think-to-carltons-take-on-auth-user/34672/17 "2024-09-23T00:36:50Z")